Apache Tomcat: WebSocket authentication header exposure (Apache Software Foundation Apache Tomcat)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.65 % · percentile 51 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Analyzed
Description
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | CISA-ADP |
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-fv25-8xcx-gqjc — Apache Tomcat - WebSocket authentication header exposure
European references
- ENISA EUVD · EUVD-2026-29515
- GCVE · GCVE-0-2026-42498
CERT-FR advisories
- CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0986 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0773 — Multiples vulnérabilités dans les produits Atlassian · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0577 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 7.0.0 ≤ 7.0.109cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 8.5.0 ≤ 8.5.100cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.0.118cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 10.1.0 < 10.1.55cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 11.0.0 < 11.0.22
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Tomcat | affected 11.0.0-M1 ≤ 11.0.21 ; affected 10.1.0-M1 ≤ 10.1.54 ; affected 9.0.2 ≤ 9.0.117 ; affected 8.5.24 ≤ 8.5.100 ; affected 7.0.83 ≤ 7.0.109 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |